Tutorial: Security of quantum key distribution: approach from - - PowerPoint PPT Presentation

Tutorial: Security of quantum key distribution: approach from complementarity

QCrypt2020: Aug. 12, 2020

• Univ. of Tokyo Masato Koashi

0100101 0100111 Sifted key 0100101 0100101 ??0?1?? 0101 0101 ????

Quantum key distribution (QKD)

Estimating the amount of leak from observed test data Alice Bob Eve Shortening the key to remove the leaked portion Sifted key Final key Final key

Weak light pulses

Privacy amplification

Public communication

measurement

signals tests

Error correction

Optical channel

Explain how we can prove the security of QKD protocols against general attacks, focusing on the approach with “phase errors,”

Aim of this tutorial

which dates back to Mayers, Shor and Preskill. PART I: Methodology PART II: Protocols

Step 1: Perfect world (Basic idea) Step 2: Almost perfect world (Composable security) Step 3: Practical world (Privacy amplification) BB84 B92 TF-QKD RRDPS DM-CV QKD

STEP 1: Perfect world

𝑨 0101 𝑨′ 0101

Goal of QKD

Alice Bob Eve Final key Final key

Ideal property of the final key

・Correlation-free ・Uniformly distributed ・Error-free 𝐿 bits 𝐿 bits Quantum description 𝜍

, 𝑞𝑨, 𝑨 𝑨⟩⟨𝑨

• ,

⊗ 𝑨′⟩⟨𝑨′ ⊗ 𝜍𝑨, 𝑨 𝜍

, 2 𝑨⟩⟨𝑨

• ⊗ 𝑨⟩⟨𝑨 ⊗ 𝜍

General state: Ideal state: 𝜍 𝑨, 𝑨 𝜍 ∀𝑨, 𝑨′ 𝑞 𝑨, 𝑨 0 whenever 𝑨 𝑨′ Quantum System E ∑ 𝑞 𝑨, 𝑨 ∑ 𝑞 𝑨, 𝑨

• 2

𝑨 0101 𝑨′ 0101

Dividing the requirement

Alice Bob Eve Final key Final key

Ideal property of the final key

・Correlation-free ・Uniformly distributed ・Error-free 𝐿 bits 𝐿 bits

𝜍

, 𝑞𝑨 𝑨⟩⟨𝑨

• ⊗ 𝜍𝑨

𝜍

, 2 𝑨⟩⟨𝑨

• ⊗ 𝜍

Property of 𝜍

,: Tr𝜍 ,

Ideal state: 𝜍 𝑨, 𝑨 𝜍 ∀𝑨, 𝑨′ Prob 𝑨, 𝑨 0 whenever 𝑨 𝑨′ Quantum System E Secrecy (for Alice) 𝜍 𝑨 𝜍 ∀𝑨 Correctness Prob 𝑨 2 General state: Overall security 𝑞 𝑨, 𝑨 0 whenever 𝑨 𝑨′ ∑ 𝑞 𝑨, 𝑨 ∑ 𝑞 𝑨, 𝑨

• 2

Starting point: Cases when it is obviously secure

𝜍

, 2 𝑨⟩⟨𝑨

• ⊗ 𝜍

|＋⟩ |0⟩ |1⟩/ 2

1

X basis eigenstate (a pure state) Z basis measurement ・Correlation-free ・Uniformly distributed If system A is in a pure state, it has no correlation to another system. If system A has non-zero correlation to another system, it is in a mixed state.

contrapositive H/V polarization Circularly polarized photon 1/2-Spin particle pointing (+x) direction A single photon fed to one input port Output ports of a half beam splitter Z component of spin

In what situation are we sure of achieving the ideal state?

Starting point: Cases when it is obviously secure

𝜍

, 2 𝑨⟩⟨𝑨

• ⊗ 𝜍

|＋⟩ |0⟩ |1⟩/ 2 ・Correlation-free ・Uniformly distributed

1 1

𝜍

,

Let us define the outcome ‘0000000’ as ‘success’. Any other outcome is a failure. In what situation are we sure of achieving the ideal state?

Starting point: Cases when it is obviously secure

𝜍

, 2 𝑨⟩⟨𝑨

• ⊗ 𝜍

・Correlation-free ・Uniformly distributed

1 1

𝜍

,

Let us define the outcome ‘0000000’ as ‘success’. Any other outcome is a failure. ? ? ? ? ? If there is a promise that the failure probability is zero, 𝜍

, 𝜍 ,

In what situation are we sure of achieving the ideal state?

So what?

𝜍

, 2 𝑨⟩⟨𝑨

• ⊗ 𝜍

|＋⟩ |0⟩ |1⟩/ 2

1 1

𝜍

,

Bob: “Well, I’d be happy to see Alice’s key is secret, but the thing is, I don’t know her key either…” In what situation are we sure of achieving the ideal state? Alice: “I am a sender of optical pulses. I see no qubits in my transmitter.”

Converting a sender to a receiver

Alice: “I am a sender of optical pulses. I see no qubits in my transmitter.” 1 Actual transmitter An entangled state

+

1 2 1 2

=

Probability 50% Probability 50%

A horizontally polaraized photon A vertically polarized photon

1 Equivalent Cases with a larger number of states, mixed states, and different probabilities are the same, except that the size of virtual quantum system may be larger. Then a qubit can be defined in a security proof.

Freedom of Z rotation

1 1

𝜍

,

? ? ? ? ? If there is a promise that the failure probability is zero, 𝜍

, 𝜍 ,

1 1

𝜍

,

? ? ? ? ? Z axis rotations

Operations that commute with for every qubit

𝑎 ≔ 0⟩⟨0 1⟩⟨1

“Z-preserving” operations

Bob: “Well, I’d be happy to see Alice’s key is secret, but the thing is, I don’t know her key either…”

Freedom of Z rotation

1 1

𝜍

,

? ? ? ? ? If there is a promise that the failure probability is zero, 𝜍

, 𝜍 ,

Z axis rotations are freely allowed to decrease the failure probability. Bob: “Well, I’d be happy to see Alice’s key is secret, but the thing is, I don’t know her key either…”

Entanglement

1 1

𝜍

,

= +

1 2 1 2

= +

1 2 1 2 Bob Bob

1 1 1 1

instruction Secrecy (for Alice) Correctness

Security from complementarity

1 1

𝜍

,

1 1

Bob tries to guess Alice’s final key If there is a promise that the failure probability is zero, 𝜍

, 𝜍 ,

Bob tries to help resetting Alice’s qubits to 0 on X basis

Security from complementarity

1 1

𝜍

,

1 1

Bob tries to guess Alice’s final key Bob tries to help resetting Alice’s qubits to 0 on X basis

Classical channel

Both tasks are perfectly feasible 𝐿 ebits of entanglement

MK, arXiv:0704.3661

Security from complementarity

1 1

𝜍

,

1 1

Bob tries to guess Alice’s final key If there is a promise that the failure probability is zero, 𝜍

, 𝜍 ,

Bob tries to help resetting Alice’s qubits to 0 on X basis A′

Quantum channel “Z-preserving” operations

MK, New J. Phys., 11, 045018 (2009); MK, arXiv:0704.3661

Security from complementarity

1 1

𝜍

,

1 1

Bob tries to guess Alice’s final key Bob tries to help resetting Alice’s qubits to 0 on X basis Erasing info on Alice’s final key Learning Alice’s final key Bob has a choice between a pair of mutually exclusive tasks

STEP 2: Almost perfect world

Small imperfection

1 1

𝜍

,

1 1

Bob tries to guess Alice’s final key If there is a promise that the failure probability is 𝜀, 𝜍

, is close to 𝜍 ,.

Bob tries to help resetting Alice’s qubits to 0 on X basis A′ We want a theorem looking like

Measure of imperfection

𝜍

, 𝑞𝑨, 𝑨 𝑨⟩⟨𝑨

• ,

⊗ 𝑨′⟩⟨𝑨′ ⊗ 𝜍𝑨, 𝑨 𝜍

, 2 𝑨⟩⟨𝑨

• ⊗ 𝑨⟩⟨𝑨 ⊗ 𝜍

Actual state: Ideal state: Proper measure of closeness? A standard measure in QKD (Universal composable security) 1 2 𝜍

, 𝜍 ,

• 𝐵 ≔ Tr

𝐵𝐵 ・Use of trace distance Monotonicity: 𝜍 𝜏 Λ 𝜍 Λ 𝜏

for any CPTP map Λ.

Triangle inequality: 𝜍 𝜏 𝜍 𝜐 𝜐 𝜏 ・Specification of 𝜍 𝜍 Tr 𝜍

, Tr 𝜍 , 𝑞𝑨, 𝑨

• ,

𝜍𝑨, 𝑨 ・Regard system E as ‘everything’, not just an adversary’s system.

(As long as you are proving security against general attacks, you don’t have to worry about this difference.)

Ben-Or, M. Horodecki, Leung, Mayers, Oppenheim, in Proc. 2nd Theory Cryptogr. Conf., 3378, 386 (2005)

Universal composable security

Actual QKD protocol 𝑨 𝑨′

Interaction with Quantum channel

𝐿

Key length Public Announcement Final key Final key

Ideal QKD protocol 𝑨′′ 𝑨′′

Interaction with Quantum channel

𝐿

Key length Public Announcement Final key Final key

Actual QKD protocol 𝑨 𝑨′ 𝑨′′ 𝑨′′

Ideal key Ideal key

Actual protocol Ideal protocol State of the gray area: 𝜍 𝜍

The protocol is 𝜗‐secure: It is guaranteed that

1 2 𝜍 𝜍

𝜗

For any event in the future, Monotonicity: 𝜍 𝜏 Λ 𝜍 Λ 𝜏

• Prob 𝑓𝑤𝑓𝑜𝑢 actual Prob 𝑓𝑤𝑓𝑜𝑢 ideal

𝜗

Universal composable security

State of the gray area: 𝜍 𝜍

,

• 𝜍 𝜍

,

• 𝜍

, 𝑞𝑨, 𝑨 𝑨⟩⟨𝑨

• ,

⊗ 𝑨′⟩⟨𝑨′ ⊗ 𝜍𝑨, 𝑨 2 𝑨′′⟩⟨𝑨′′

• ⊗ 𝑨⟩𝑨

⊗ 𝑞 𝑨, 𝑨

• ,

𝜍 𝑨, 𝑨 𝜍

,

Actual protocol Ideal protocol 𝑨′ 𝑨 𝐿 𝐿 𝑨′′ 𝑨′′ Tr 𝜍

, Tr 𝜍 ,

Universal composable security

State of the gray area: 𝜍 𝜍

,

• 𝜍 𝜍

,

• A QKD protocol is 𝜗‐secure if

1 2 𝜍

, 𝜍 ,

• 𝜗
• 1

2 𝜍

, 𝜍 ,

• Actual protocol

Ideal protocol 𝑨′ 𝑨 𝐿 𝐿 𝑨′′ 𝑨′′

Universal composable security

𝜗‐secure protocol 𝜗′‐secure protocol 𝜗‐secure protocol Ideal protocol 𝜍 ideal protocol Ideal protocol 𝜍 ?

Universal composable security

𝜗‐secure protocol 𝜗′‐secure protocol 𝜗‐secure protocol Ideal protocol 𝜍 ideal protocol Ideal protocol 𝜍 ? 𝜗′

Universal composable security

𝜗‐secure protocol 𝜗′‐secure protocol 𝜗‐secure protocol Ideal protocol 𝜍 ideal protocol Ideal protocol 𝜍 ? 𝜗′ 𝜗

Universal composable security

𝜗‐secure protocol 𝜗′‐secure protocol 𝜗‐secure protocol Ideal protocol Triangle inequality: 𝜍 𝜏 𝜍 𝜐 𝜐 𝜏 𝜍 ideal protocol Ideal protocol 𝜍 1 2 𝜍 𝜍

𝜗 𝜗′

𝜗 𝜗′ 𝜗′ 𝜗

Universal composable security

Dividing the requirement

Imperfection of the final key

Prob 𝑨 𝑨 𝜗′′ Secrecy (for Alice) Correctness Overall security (𝜗‐secure) 1 2 𝜍

, 𝜍 ,

• 𝜗

1 2 𝜍

, 𝜍 ,

• 𝜗′ (𝜗′‐secret)

(𝜗′′‐correct) With 𝜗 𝜗’+ 𝜗’’

𝜍

, 𝑞𝑨 𝑨⟩⟨𝑨

• ⊗ 𝜍𝑨

𝜍

, 2 𝑨⟩⟨𝑨

• ⊗ 𝜍

𝜍

, 2 𝑨⟩⟨𝑨

• ⊗ 𝑨⟩⟨𝑨 ⊗ 𝜍

𝜍

, 𝑞𝑨, 𝑨 𝑨⟩⟨𝑨

• ,

⊗ 𝑨′⟩⟨𝑨′ ⊗ 𝜍𝑨, 𝑨 𝑞𝑨, 𝑨 𝑨⟩⟨𝑨

• ,

⊗ 𝑨⟩⟨𝑨 ⊗ 𝜍𝑨, 𝑨 𝜗′ 𝜗′ 𝜗′′

Small imperfection

1 1 1 1

Bob tries to guess Alice’s final key If there is a promise that the failure probability is 𝜀, the protocol is 𝜗‐secret. Bob tries to help resetting Alice’s qubits to 0 on X basis A′ We want a theorem looking like

Small imperfection

1 1 1 1

Bob tries to guess Alice’s final key If there is a promise that the failure probability is 𝜀, the protocol is 2𝜀‐secret. Bob tries to help resetting Alice’s qubits to 0 on X basis A′ 2𝜀‐secret Failure 𝜀

Relation between failure probability and secrecy

1 1

𝜍

,

𝜀 failure: 𝜏

,

𝜏

,

• ⟨𝜒
• ||＋⟩ ⟨
• | |𝜒⟩

＋ 𝜍: Tr 𝜍

, Tr 𝜏 ,

1 𝜀 Tr ⟨

• |

＋ 𝜏

,|＋⟩

𝜍 𝜏

,

Tr Tr |𝜒⟩

Hayashi, Tsurumaru, New J. Phys., 14, 093014 (2012).

Relation between failure probability and secrecy

1 1

𝜍

,

𝜏

,

𝜍 Tr𝜍

,

1 1

𝜍

,

𝜏

,

• ⟨𝜒
• ||＋⟩ ⟨
• | |𝜒⟩

＋ ⟨

• |

＋ 𝜏

,|＋⟩

𝜍 𝜏

,

Tr Tr |𝜒⟩ 𝜏

,

|＋⟩ ⟨

• |

＋ ⊗ 𝜍 |＋⟩ |𝜒⟩ Tr 𝜏

,

|Φ⟩ ≔ |＋⟩ |𝜒⟩ Tr 𝜏

,

|Ψ⟩ ≔ Φ Ψ

⟨𝜒

• ||＋⟩

⟨

• ||𝜒⟩

＋

1 𝜀 1 𝜀 Tr

Hayashi, Tsurumaru, New J. Phys., 14, 093014 (2012).

Relation between failure probability and secrecy

1 1

𝜍

,

𝜏

,

𝜍 Tr𝜍

,

1 1

𝜍

,

𝜏

,

𝜍 𝜏

,

Tr Tr |𝜒⟩ 𝜏

,

|＋⟩ ⟨

• |

＋ ⊗ 𝜍 |＋⟩ |𝜒⟩ Tr 𝜏

,

|Φ⟩ ≔ |＋⟩ |𝜒⟩ Tr 𝜏

,

|Ψ⟩ ≔ Φ Ψ

⟨𝜒

• ||＋⟩

⟨

• ||𝜒⟩

＋

1 𝜀 𝐺𝜏

,, 𝜏 ,

Φ Ψ

1 𝜀 1 2𝜀

1 2 𝜍

, 𝜍 ,

1 𝐺 2𝜀 2𝜀 2 𝜀 2𝜀

Hayashi, Tsurumaru, New J. Phys., 14, 093014 (2012).

Small imperfection

1 1 1 1

Bob tries to guess Alice’s final key If there is a promise that the failure probability is 𝜀, the protocol is 2𝜀‐secret. Bob tries to help resetting Alice’s qubits to 0 on X basis A′ 2𝜀‐secret Failure 𝜀

STEP 3: Practical world

Small imperfection

1 1 1 1

Bob tries to guess Alice’s final key Bob tries to help resetting Alice’s qubits to 0 on X basis 2𝜀‐secret This scenario works if entanglement distillation is actually carried out. 𝜗′′‐correct Failure 𝜀

Lo, Chau, Science, 283, 2050 (1999).

Realistic cases

1 1 1 1

Bob tries to guess Alice’s sifted key ≅ 1 Failure

1 1

Bob tries to help resetting Alice’s qubits to 0 on X basis insecure Bit errors Phase errors Sifted key (N bits)

Realistic cases

1 1 1 1

Bob tries to guess Alice’s sifted key

1 1

Bob tries to help resetting Alice’s qubits to 0 on X basis A promise on statistical property

• f phase errors

Sifted key (N bits) Privacy amplification Final key (K bits)

1

𝜗‐secret What we want: e.g. The number of phase errors 𝑂𝑓 except a small probability 𝜀

Realistic cases

1 1 1 1

Bob tries to guess Alice’s sifted key

1 1

Bob tries to help resetting Alice’s qubits to 0 on X basis A promise on statistical property

• f phase errors

Sifted key (N bits) Privacy amplification Final key (K bits)

1

What we want: e.g. The number of phase errors 𝑂𝑓 except a small probability 𝜀 𝐼 bits 𝜗‐secret In this talk, we assume that Alice helps Bob by sending 𝐼 bits of encrypted message, by consuming as many bits of secret key. The net key gain of the QKD protocol is 𝐻 𝐿 𝐼.

Privacy amplification

Sifted key Privacy amplification Final key (Bob also applies the same procedure to his sifted key.) Final key (K bits) Sifted key (N bits)

1 1 = 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

1 1 1 1

A randomly chosen matrix N qubits

Approach with leftover hashing lemma

Sifted key Privacy amplification Final key Final key (K bits) Sifted key (N bits)

1 1 = 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

1 1 1 1

A randomly chosen matrix N qubits Eve’s quantum system

Renner (2005)

𝐼

• 𝐵 𝐹

Tsurumaru, IEEE Trans. Inf. Theory, 66, 3465 (2020).

Leftover hashing lemma Relations between the two approaches Bob’s quantum system

Privacy amplification

Sifted key Privacy amplification Final key Final key (K bits) Sifted key (N bits)

1 1 = 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

1 1 1 1

A randomly chosen matrix N qubits

Privacy amplification

Sifted key Privacy amplification Final key

1 1

1 1 1 1 = 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

Quantum circuit

(Z basis) N qubits Final key (K bits) K qubits

Example: a controlled-NOT gate

• n X basis
• n Z basis

Matrix 𝐷 Matrix 𝐷

1 1 = 1 1 1 1

The same quantum circuit

1 1 = 1 1 1 1

Privacy amplification

1 1

1 1 1 1 = 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

Quantum circuit

(Z basis) N qubits Final key (K bits) K qubits

Privacy amplification

N qubits K qubits

1 1 1 1 = 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

Quantum circuit

(X basis)

1 1

e.g.

A promise on statistical property of phase error patterns 𝒚∗

The number of phase errors 𝑂𝑓 except a small probability 𝜀

2𝜀‐secret failure 𝜀 Privacy amplification to K bits Phase error correction via (N-K) bits of hints On Z basis: On X basis: 𝒚∗

Number of possible phase error patterns (N‐bit string 𝒚∗)

The number of phase errors 𝑂𝑓

Amount of privacy amplification (Rough)

N qubits K qubits

1 1 1 1 = 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

Quantum circuit

(X basis)

1 1

e.g.

2𝜀‐secret failure 𝜀

2

𝐼 𝑂ℎ𝑓

ℎ 𝑦 ≔ 𝑦log𝑦 1 𝑦 log1 𝑦

Every bit halves the number of candidates. Phase error correction will succeed if 𝐼 𝑂 𝐿 Secure final key length 𝐿 ≅ 𝑂 𝐼 𝒚∗

One can choose a candidate set 𝑈 of probable phase error patterns such that

Amount of privacy amplification (Strict)

N qubits K qubits

1 1 1 1 = 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

Quantum circuit

(X basis)

1 1

2𝜀‐secret failure 𝜀

|𝑈| 2

𝒚∗ Prob 𝒚∗ ∈ 𝑈 1 𝜀 Every wrong candidate in 𝑈 is eliminated except probability 2 Choose the final key length 𝐿 as 𝐿 𝑂 𝐼 𝑡 failure 𝜀 2 𝑈 𝜀 2 𝜀

Finite-size security

1 1 1 1

Bob tries to guess Alice’s sifted key

1 1

Bob tries to help resetting Alice’s qubits to 0 on X basis Sifted key (N bits) Privacy amplification Final key (K bits)

1

𝜍

,

𝜗‐secret The protocol is

with 𝜗 2 2 𝜀

|𝑈| 2

Prob 𝒚∗ ∈ 𝑈 1 𝜀 𝐿 𝑂 𝐼 𝑡 or 0 𝒚∗

Recipe

1 1 1

Alice’s sifted key

1 1 1 1 1

Bob Eve Eve

?

• 1. Rewrite the protocol such that Alice’s sifted key is the Z values of qubits.
• 2. Find what Bob could have done to help reducing phase errors.

(It must be compatible to Bob’s announcement)

• 3. Compute a bound on the number of phase error patterns.

Remarks

‘Phase error probability’ or ‘Phase error rate’ 𝑓 in the asymptotic limit Number of phase errors

𝑂𝑓 𝜀

• except probability 𝜀
• 𝜀

, 𝜀 → 0 for 𝑂 → ∞

𝐼 𝑂ℎ𝑓 𝜀

• 𝐿

𝑂 1 ℎ 𝑓 𝜀

• 𝑡

𝑂 → 1 ℎ 𝑓 Asymptotic efficiency of privacy amplification

Remarks

1 1 1 1

Eve

?

Sifted key bits are tagged and classified: 𝑂 ∑ 𝑂

• Phase error probability 𝑓

depending on the tag value 𝑢

𝑢 0 𝑢 1 𝑢 0 𝑢 1 𝑢 0

𝑂 𝑂 → 𝑅

Number of phase error patterns: ∼ ∏ 2^𝑂 ℎ 𝑓

• 𝐼 ∼ 𝑂 ℎ 𝑓
• 𝐿

𝑂 → 1 𝑅 ℎ 𝑓

• Tagging

Gottesman, Lo, Lutkenhaus, Preskill, Quant. Inf. Comput. 5, 325 (2004).

PART II: Protocols

Ideal BB84 protocol

0101… Alice Bob Eve 1 1 1 Sifted key

Signal Test

+

1 2 1 2

=

Assumption: Detection probability has no dependence on the basis, for any input.

Signal Test

Announcement

• f detection

+

1 2 1 2

Ideal BB84 protocol

0101… Alice Bob Eve Sifted key

=

1

Signal Test

Assumption: Detection probability has no dependence on the basis, for any input.

Signal Test

Announcement

• f detection

Ideal BB84 protocol

Alice Bob Eve

+

1 2 1 2

= +

1 2 1 2

=

1

Signal Test

Assumption: Detection probability has no dependence on the basis, for any input.

Signal Test

Announcement

• f detection

Ideal BB84 protocol

1 1 1

Alice’s sifted key

1 1

Bob Eve Eve

?

Ideal BB84 protocol

1 1 1

Alice’s sifted key

1 1 1 1 1

Bob Eve Eve

1 1

Eve

Test mode Signal mode

Ideal BB84 protocol

Alice Bob Eve 1

Signal Test

Assumption: Detection probability has no dependence on the basis, for any input.

Signal Test

Fair sampling Errors found in the test mode are fair sampling of phase errors Asymptotic key length: 𝐿 ∼ 𝑂1 ℎ 𝑓 Finite‐size: classical sampling theory is enough. Simple random sampling

A fixed number of samples drawn

Bernoulli sampling

Hypergeometric distribution Samples drawn with a fixed probability Binomial distribution

𝑄 𝑄 𝑄 𝑄 𝑄 𝑄 𝑄

Announcement

• f detection

Kawakami, Sasaki, MK, Phys. Rev. A, 96, 012305 (2017).

BB84 protocol with phase-randomized laser pulses

A 𝜍 𝑞𝑜 𝑜⟩⟨𝑜

• C

Alice emits a phase‐randomized pulse in a mode C 𝑜: number of photons 𝜍 𝑞𝑜 𝑜⟩⟨𝑜 𝑜⟩⟨𝑜

• C

𝑜

Tr𝜍 𝜍

• → 1 𝑅 ℎ 𝑓

𝑅 ℎ 𝑓 𝑅 ℎ 𝑓

• Asymptotic rate

1 𝑅 ℎ 𝑓

𝑅

Tighter estimation of the parameters is done by decoy‐state technique.

Lo, arXiv:quant‐ph/0503004

Binary phase encoding

Alice Bob Eve 1 1 1

Signal

=

π π π π

+

1 2 1 2

= +

even

• dd

Schrodinger cat states

| 𝛽⟩ | 𝛽⟩

Coherent states

Used in many protocols: B92, DPS, RRPDS, a Twin-field(PM), a DM-CV, … c𝛽 𝑡𝛽

|𝛽⟩ |𝛽⟩

c 𝛽 𝑡 𝛽 1 𝑡 𝛽 𝑓sinh 𝛽 𝛽 𝑃𝛽

Prob.of |ー⟩, corresponding to the amount of information in the signal.

B92 protocol

0101… Alice Bob Eve 1 1 1 Sifted key

Signal Test

Announcement

• f detection

π π π π π

| 𝛽⟩ | 𝛽⟩ 1 | 𝛾⟩⟨𝛾| 2

Coherent states

1 |＋𝛾⟩⟨＋𝛾| 2

𝛾 ≔ 𝜃𝛽

Nominal received amplitude

Outcome 0: Outcome 1:

1 failure

B92 Outcome ‘failure’: c 𝛾 |𝛾⟩𝛾| 𝑡 𝛾 |𝛾⟩𝛾| input LO

|＋𝛾⟩ Photon detector

| 𝛾⟩

𝜃: channel transmission

B92 protocol

1 1 1

Alice’s sifted key

1 failure 1 1 1

Bob Eve Eve

?

B92 B92 B92 B92 B92

even even even

• dd
• dd

1 |𝛾⟩

B92 protocol: Analysis of phase error probability

Basis: |＋⟩ |ー⟩ |𝛾⟩ |𝛾⟩ |𝑝𝑢ℎ𝑓𝑠𝑡⟩ Phase error No Phase error |ー⟩ |＋⟩ |𝛾⟩ |𝛾⟩ |＋⟩ |ー⟩|𝑝𝑢ℎ𝑓𝑠𝑡⟩ |𝑝𝑢ℎ𝑓𝑠𝑡⟩ 1 |𝛾⟩ |𝛾⟩ |ー⟩ |＋⟩|𝛾⟩ Bit error:1/2 Bit error:1/2 Probability of

𝑡 𝛽 𝑡 𝛾 𝑑 𝛾 1 2

1 |ー⟩

Tamaki, MK, Imoto, Phys. Rev. Lett., 90, 167904 (2003), MK, Phys. Rev. Lett., 93, 120501 (2004)

B92 protocol: Analysis of phase error probability

Basis: |＋⟩ |ー⟩ |𝛾⟩ |𝛾⟩ |𝑝𝑢ℎ𝑓𝑠𝑡⟩ Phase error No Phase error |ー⟩ |＋⟩ |𝛾⟩ |𝛾⟩ |＋⟩ |ー⟩|𝑝𝑢ℎ𝑓𝑠𝑡⟩ |𝑝𝑢ℎ𝑓𝑠𝑡⟩ 1 |𝛾⟩ |𝛾⟩ |ー⟩ |＋⟩|𝛾⟩ Bit error:1/2 Bit error:1/2

𝑡 𝛽 𝑡 𝛾 𝑑 𝛾 1 2

If bit error prob. is zero …. Only the two states are allowed. The average must be the initial value 𝑡 𝛽 , since Eve cannot touch Alice’s qubit. Phase error probability is 𝑓 𝑡 𝛽 𝛾

• (consistent with beam splitting attack)

1 Probability of |ー⟩

MK, Phys. Rev. Lett., 93, 120501 (2004)

B92 protocol: Analysis of phase error probability

Basis: |＋⟩ |ー⟩ |𝛾⟩ |𝛾⟩ |𝑝𝑢ℎ𝑓𝑠𝑡⟩ Phase error No Phase error |ー⟩ |＋⟩ |𝛾⟩ |𝛾⟩ |＋⟩ |ー⟩|𝑝𝑢ℎ𝑓𝑠𝑡⟩ |𝑝𝑢ℎ𝑓𝑠𝑡⟩ 1 |𝛾⟩ |𝛾⟩ |ー⟩ |＋⟩|𝛾⟩ Bit error:1/2 Bit error:1/2

𝑡 𝛽 𝑡 𝛾 𝑑 𝛾 1 2

Given Bit error prob. Detection prob. Compute the worst phase error prob. 1 Asymptotic: Finite‐size: Azuma’s inequality Probability of |ー⟩

Twin-Field QKD

Twin-Field protocol (Toshiba Europe) Lucamarini et al., Nature 557, 400 (2018).

Untrusted (taken over by Eve)

π

Only uses lasers, linear optics, and photon detectors.

Expected key rate scaling in TF-QKD

Twin-Field protocol (Toshiba Europe) Lucamarini et al., Nature 557, 400 (2018).

It is expected that the achievable distance is doubled.

Pirandola, Laurenza, Ottaviani & Banchi., Nat.

• Commun. 8, 15043 (2017).

Twin-Field QKD

Twin-Field protocol (Toshiba Europe) Lucamarini et al., Nature 557, 400 (2018).

Alice Bob

• cf. A prepare‐and‐measure QKD

Detection!

A photon travels only half the distance between Alice and Bob.

Twin-Field QKD

Twin-Field protocol (Toshiba Europe) Lucamarini et al., Nature 557, 400 (2018).

Alice Bob Detection!

A photon travels only half the distance between Alice and Bob.

• cf. A prepare‐and‐measure QKD

Twin-Field-type QKD

0101… Alice Bob 1 1 1 Sifted key

Signal

π π π

| 𝛽⟩ | 𝛽⟩

“Phase‐Matching” protocol

Ma, Zeng & Zhou, Phys. Rev. X 8, 031043 (2018).

Announcement: Detected (in phase/out of phase) Failed Eve/ Charlie

Test mode: Many variants of PM protocols

π π

TF-type QKD (PM protocol)

1 1 1

Alice’s sifted key

1 1

Bob Eve/ Charlie

even even even

• dd
• dd
• dd

even

• dd

even even

1 1 1

Eve/ Charlie

1 1 1

(Only the detected rounds are shown) even even

• dd
• dd

results in a phase error. The cases with

Alice Bob 1

Signal

π

| 𝛽⟩ | 𝛽⟩

Announcement: Detected (in phase/out of phase) Failed Eve/ Charlie

Test mode:

TF-type QKD (PM protocol)

even even

• dd
• dd

=

𝑟 ≔ c 𝛽 c 𝛽 𝑡 𝛽 𝑟 1 𝑟 |𝛽⟩ |𝛽⟩ |𝛽⟩ |𝛽⟩ Phase error probability Estimation of detection rate of (by only using coherent states) Asymptotic: Many designs proposed. Finite‐size: ・Reduction to Bernoulli sampling (Operation dominance method) ・(Improved version of) Azuma’s inequality

1) Maeda, Sasaki, MK, Nat. Commun. 10, 3140 (2019). 2) Lorenzo, Navarrete, Azuma, Curty, Razavi, arXiv:1910.11407. 3) Kato, arXiv:2002.04357. 1) 3) 2)

Alice

π π π

detection 1 2 3 4 5 6 1 2 3 4 5 6

𝑗, 𝑘 3,5

1

…

VD

Bob Variable delay 1 1

𝑗, 𝑘 3,5

1 1 ⊕ 0 1 Alice’s sifted key bit Bob’s sifted key bit

π

| 𝛽⟩ | 𝛽⟩

Block of 𝑀 pulses

Sasaki, Yamamoto, MK, Nature 509 509, 475 (2014).

Round Robin DPS QKD

Security from complementarity

1 1

𝜍

,

1 1

Bob tries to guess Alice’s final key Bob tries to help resetting Alice’s qubits to 0 on X basis Erasing info on Alice’s final key Learning Alice’s final key Bob has a choice between a pair of mutually exclusive tasks

What is the working principle of QKD?

Alice Bob Eve Law of quantum mechanics

Conventional QKD RRDPS QKD

Nothing to do with quantum Eve’s attempts to eavesdrop should leave a trace, which can be monitored. Alice Bob Eve Eve has only a small chance to read out the bit, just because the signal is weak. Law of quantum mechanics

Round Robin DPS QKD

Alice

π π π

detection 1 2 3 4 5 6 1 2 3 4 5 6

𝑗, 𝑘 3,5

1

…

VD

Bob Variable delay 1 1

𝑗, 𝑘 3,5

1 1 ⊕ 0 1 Alice’s sifted key bit Bob’s sifted key bit

π

| 𝛽⟩ | 𝛽⟩

Block of 𝑀 pulses

Sasaki, Yamamoto, MK, Nature 509 509, 475 (2014).

RRDPS QKD

Alice

π π π

1

…

VD

Bob Variable delay 1 1

𝑗, 𝑘 3,5

1 1 ⊕ 0 1 Bob’s sifted key bit Block of 𝑀 pulses

Assumption: Total number of photons is no larger than 𝜉 1 2 3 4 5 4 5 1 2 3

1 Assumption:

RRDPS protocol

1 1 1

Alice’s sifted key

1 failure 1 1 1

Bob Eve Eve

?

⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀 ⊗ 𝑀

RRDPS QKD

𝑗, 𝑘 3,5 𝑀 pulses sifted key bit

⊗ 𝑀 ⊗ 𝑀

𝑗 𝑘 1

1 2 3 4 5 detection 4 5 1 2 3

RRDPS QKD

𝑀 pulses phase error

⊗ 𝑀 ⊗ 𝑀

𝑗 𝑘

1 1

1

1 2 3 4 5 detection 4 5 1 2 3 Assumption: Total number of photons is no larger than 𝜉

No more than 𝜉 qubits are in state 𝑗, 𝑘 3,5

RRDPS QKD

𝑀 pulses

⊗ 𝑀 ⊗ 𝑀

𝑗 𝑘

1 1

1 2 3 4 5 detection 4 5 1 2 3 Assumption: Total number of photons is no larger than 𝜉

No more than 𝜉 qubits are in state 𝑗, 𝑘 3,5

detection

The index 𝑘 is uniformly random.

Probability of phase error

𝜉 𝑀 1 phase error

RRDPS QKD

𝑀 pulses

⊗ 𝑀 ⊗ 𝑀

𝑗 𝑘

1 1

1 2 3 4 5 detection 4 5 1 2 3 Assumption: Total number of photons is no larger than 𝜉

No more than 𝜉 qubits are in state 𝑗, 𝑘 3,5

detection

The index 𝑗 is uniformly random.

Probability of phase error

𝜉 𝑀 1 phase error

RRDPS QKD

𝑀 pulses

⊗ 𝑀 ⊗ 𝑀

𝑗 𝑘

1 1

1 2 3 4 5 detection 4 5 1 2 3 Assumption: Total number of photons is no larger than 𝜉

No more than 𝜉 qubits are in state 𝑗, 𝑘 3,5

detection

The index 𝑗 is uniformly random.

Probability of phase error

𝜉 𝑀 1 phase error

RRDPS QKD

𝑀 pulses

⊗ 𝑀 ⊗ 𝑀

𝑗 𝑘

1 1

𝑗, 𝑘 3,5

Probability of phase error

𝜉 𝑀 1 phase error Asymptotic key length: 𝐿 ∼ 𝑂 𝑂ℎ 𝜉 𝑀 1 Finite‐size: No sampling needed. Just a Bernoulli trial.

What is the working principle of QKD?

Alice Bob Eve Law of quantum mechanics

Conventional QKD RRDPS QKD

Nothing to do with quantum Eve’s attempts to eavesdrop should leave a trace, which can be monitored. Alice Bob Eve Eve has only a small chance to read out the bit, just because the signal is weak. Law of quantum mechanics

CV-QKD

LASER

signal photodetector photodetector

ー

Homodyne/Heterodyne detection Continuous-variable QKD CV-QKD was off limits to the phase error approach.

A two-state CV-QKD protocol

1

Signal Test

π π

| 𝛽⟩ | 𝛽⟩

Coherent states

1 | 𝛾⟩⟨𝛾| 2 1 |＋𝛾⟩⟨＋𝛾| 2

𝛾 ≔ 𝜃𝛽 Outcome 0: Outcome 1:

1 failure

B92 The B92 measurement has two roles. Signal: Selecting out only favorable events. 𝑦

Acceptance probability

1 “0” “1” “failure”

Matsuura, Maeda Sasaki, MK, arXiv: 2006.04661.

2-state CV protocol

1 1 1

Alice’s sifted key

1 failure 1 1 1

Bob Eve Eve

?

even even even

• dd
• dd

2-state CV protocol

1 1 1

Alice’s sifted key

1 failure 1 1 1

Bob Eve Eve

even even even

• dd
• dd

e/o e/o e/o e/o e/o e/o Parity of the photon number

A two-state CV-QKD protocol

1

Signal Test

π π

| 𝛽⟩ | 𝛽⟩

Coherent states

1 | 𝛾⟩⟨𝛾| 2 1 |＋𝛾⟩⟨＋𝛾| 2

𝛾 ≔ 𝜃𝛽 Outcome 0: Outcome 1:

1 failure

B92 The B92 measurement has two roles. Signal: Selecting out only favorable events. Test: Estimation of bit error probability ⟨＋𝛾|𝜍|＋𝛾⟩ Estimation of fidelities of the received state ⟨𝛾|𝜍| 𝛾⟩

Matsuura, Maeda Sasaki, MK, arXiv: 2006.04661.

Fidelity estimation via Heterodyne measurement

Λ, 𝜈 ≔ 𝑓 1 𝑠 𝑀

1 𝑠 𝜈

Associated Laguerre polynomial

𝔽Λ, 𝜕 ⟨0|𝜍|0⟩

𝜕 ∈ ℂ: Outcome of Heterodyne measurement 𝜍: input state The equality holds when 𝜍 has 𝑛 or fewer photons.

𝔽Λ, 𝜕 𝛾 ⟨𝛾|𝜍| 𝛾⟩

𝑛: odd integer

Matsuura, Maeda Sasaki, MK, arXiv: 2006.04661.

Λ, 𝜈 is bounded and smooth

Security proof of 2-state CV-QKD

✓ Finite-size security ✓ Against general attack

(Azumaʼs inequality)

✓ Finite measurement precision ✓ Finite constellation

Matsuura, Maeda Sasaki, MK, arXiv: 2006.04661.